
Research
PyPI Package Impersonates SymPy to Deliver Cryptomining Malware
Malicious PyPI package sympy-dev targets SymPy users, a Python symbolic math library with 85 million monthly downloads.
Share hypercores on a one to one basis like a marketplace
npm install hypermarket
First setup a seller
const hypercore = require('hypercore')
const pump = require('pump')
const market = require('./market')
const m = market('./tmp')
const feed = hypercore('./tmp/data')
feed.append('valuable')
const seller = m.sell(feed, {
validate (remoteKey, cb) {
console.log('this key wants our hypercore', remoteKey)
cb(null)
}
})
seller.on('ready', function () {
console.log('seller key pair fully loaded ...')
const buyer = m.buy(seller.key)
buyer.on('feed', function () {
console.log('got the feed!')
buyer.feed.get(0, function (err, data) {
console.log('first feed entry: ' + data)
})
})
buyer.on('validate', function () {
console.log('remote validated us')
})
const stream = seller.replicate()
pump(stream, buyer.replicate(), stream, function (err) {
console.log('replication ended', err)
})
})
const market = hypermarket(storage)Create a new hypermarket instance
const seller = market.sell(feed, options)Sell a hypercore by creating a new seller.
Options include:
{
validate (remoteKey, cb) // wheather a remote key can get a copy of this feed,
validateInterval: 1000 // how often to validate
}
seller.buyers(cb)Get a list of all the buyers of this feed
seller.on('ready')Emitted when the seller is fully ready and has loaded it's keypair
seller.discoveryKeyA hash of the sellers public key that can be used for discovery purposes.
seller.keyThe public key of this seller. Needed to buy the data.
const buyer = market.buy(sellerKey)Buy a hypercore by creating a buyer instance. It is expected that the remote seller can verify that you purchased the data through a third party some how
buyer.on('ready')Emitted when the buyer is fully ready and has fully loaded it's keypair.
buyer.keyThe buyer public key. All buyers have the same public key through out the market instance. This is the remote key the seller sees in the validate function
buyer.sellerThe seller public key.
buyer.discoveryKeyA hash of the seller public key that can be used to discover the seller on a network.
buyer.on('feed', feed)Emitted when we have a feed. If we previously succesfully validated this is triggered right away. Otherwise it is triggerd after the first remote validation.
buyer.on('validate')Emitted first time a remote seller validates us.
buyer.on('invalidate', err)Emitted when a remote seller invalidates us with the error they provided.
buyer.feedThe feed we bought.
bool = market.isSeller(instance)Helper to determine if an instance is a seller.
bool = market.isBuyer(instance)Helper to determine if an instance is a buyer.
A network swarm based on hyperswarm is included as hypermarket/swarm
const swarm = require('hypermarket/swarm')
swarm(buyer) // swarms the buyer
swarm(seller) // swarms the seller
MIT
FAQs
Marketplace for selling and buying hypercores
The npm package dazaar receives a total of 1 weekly downloads. As such, dazaar popularity was classified as not popular.
We found that dazaar demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious PyPI package sympy-dev targets SymPy users, a Python symbolic math library with 85 million monthly downloads.

Security News
Node.js 25.4.0 makes require(esm) stable, formalizing CommonJS and ESM compatibility across supported Node versions.

Product
Create and share saved alert views with custom tabs on the org alerts page, making it easier for teams to return to consistent, named filter sets.